Extracted

• • Target
    297a150f764beff592d7d449e3064ba73c2ef7c709dd8263ce1ce1579ecfb590
  • Size 535KB
  • SHA256 297a150f764beff592d7d449e3064ba73c2ef7c709dd8263ce1ce1579ecfb590
  • MD5 8cc17d7f87af197121a701df4c2f9ee6
  • SHA1 a9a22cceb8f17d4b67d360779ecd560e4e96965d
  • SHA512 8f9293b7112a66af63d2ca4ee7a5db8affe93307cc01e1ea3f083c0994c771c977811a5e6456e53f56629ac60af8dd8819708c609e8fba8f7c82f387d03bc68b
  • MD5 SHA1 SHA512

  Score

  10^/10

  persistencesuricata

  • suricata: ET MALWARE DDoS.XOR Checkin

    suricata: ET MALWARE DDoS.XOR Checkin

    suricata

  • suricata: ET MALWARE Likely Linux/Xorddos.F DDoS Attack Participation (aa.hostasa.org)

    suricata: ET MALWARE Likely Linux/Xorddos.F DDoS Attack Participation (aa.hostasa.org)

    suricata

  • Writes file to system bin folder

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Write file to user bin folder

  • Reads runtime system information

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory

    Malware often drops required files in the /tmp directory.

  behavioral1